Spyware, viruses, & security forum: VULNERABILITIES / FIXES - October 12, 2012

Mozilla Firefox / Thunderbird / SeaMonkey Multiple Vulnerabilities

Release Date : 2012-10-11
Last Update : 2012-10-12

Criticality level : Highly critical
Impact: Security Bypass
System access
Where : From remote
Solution Status : Vendor Patch

Software: Mozilla Firefox 16.x
Mozilla SeaMonkey 2.x
Mozilla Thunderbird 16.x

Description:
Some vulnerabilities have been reported in Mozilla Firefox, Thunderbird, and SeaMonkey, which can be exploited by malicious people to bypass certain security restrictions and compromise a user's system.

1) The protected "location" object is accessible by other domain objects, which can be exploited to bypass the same origin policy and gain access to sensitive information.

2) An unspecified error within the "FT2FontEntry::CreateFontEntry()" function can be exploited to corrupt memory.

3) An unspecified error within the "mozilla::net::FailDelayManager::Lookup()" function when handling certain websockets can be exploited to corrupt memory.

4) An error within security wrappers does not unwrap the "defaultValue" properly and can be exploited to gain access to the "location" object.

The vulnerabilities are reported in Firefox and Thunderbird versions prior to 16.0.1 and SeaMonkey versions prior to 2.13.1.

Solution:
Update Firefox and Thunderbird to versions 16.0.1 and SeaMonkey to version 2.13.1.

Provided and/or discovered by:
1) Gareth Heyes
2, 3) Reported by the vendor.
4) The vendor credits moz_bug_r_a4.

Original Advisory:
Mozilla:
http://blog.mozilla.org/security/2012/10/10/security-vulnerability-in-firefox-16/
http://www.mozilla.org/security/announce/2012/mfsa2012-88.html
http://www.mozilla.org/security/announce/2012/mfsa2012-89.html

Gareth Heyes:
http://www.thespanner.co.uk/2012/10/10/firefox-knows-what-your-friends-did-last-summer/

http://secunia.com/advisories/50932

Release Date : 2012-10-12

Criticality level : Less critical
Impact: DoS
Where : From local network
Solution Status : Vendor Patch

Operating System : Ubuntu Linux 10.04
Ubuntu Linux 11.04
Ubuntu Linux 11.10
Ubuntu Linux 12.04

Description:
Ubuntu has issued an update for quagga. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).

Solution:
-- Ubuntu 12.04 LTS --

Original Advisory:
USN-1605-1:
http://www.ubuntu.com/usn/usn-1605-1/

http://secunia.com/advisories/50941/

EMC NetWorker Module for Microsoft Applications Two Vulnerabilities

Release Date : 2012-10-12

Criticality level : Moderately critical
Impact: Exposure of sensitive information
System access
Where : From local network
Solution Status : Vendor Patch

Software: EMC NetWorker Module for Microsoft Applications 2.x

Description:
Two vulnerabilities have been reported in EMC NetWorker Module for Microsoft Applications, which can be exploited by malicious, local users to disclose potentially sensitive information and by malicious people to compromise a vulnerable system.

1) An error during the installation or upgrading of NMM on an Exchange server may result in disclosure of administrative credentials in clear text.

2) An error in NMM clients during certain channel communication can be exploited to submit unauthenticated specially crafted messages over TCP.

Successful exploitation of this vulnerability may allow execution of arbitrary code.

The vulnerabilities are reported in versions 2.2.1, 2.3 prior to build 122, and 2.4 prior to build 375.

Solution:
Update to version 2.3 build 122 or 2.4 build 375.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
ESA-2012-025:
http://archives.neohapsis.com/archives/bugtraq/2012-10/att-0068/ESA-2012-025.txt

http://secunia.com/advisories/50957/

Release Date : 2012-10-12

Criticality level : Less critical
Impact: Privilege escalation
DoS
Where : Local system
Solution Status : Vendor Patch

Operating System : Ubuntu Linux 11.10

Description:
Ubuntu has issued an update for the kernel. This fixes a vulnerability, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and potentially gain escalated privileges.

Solution:
Apply updated packages.

Original Advisory:
USN-1609-1:
http://www.ubuntu.com/usn/usn-1609-1/

http://secunia.com/advisories/50952/

Release Date : 2012-10-11
Last Update : 2012-10-12

Criticality level : Highly critical
Impact: System access
Where : From remote
Solution Status : Vendor Patch

Software: WebEx Recording Format Player

Description:
Multiple vulnerabilities have been reported in Cisco WebEx Recording Format Player, which can be exploited by malicious people to compromise a user's system.

1) An unspecified error can be exploited to cause a buffer overflow via a specially crafted WRF file.

2) An unspecified error can be exploited to cause a buffer overflow via a specially crafted WRF file.

3) An unspecified error can be exploited to cause a buffer overflow via a specially crafted WRF file.

4) An error in the atas32.dll module can be exploited to corrupt memory via a specially crafted WRF file.

5) An unspecified error can be exploited to cause a buffer overflow via a specially crafted WRF file.

6) An unspecified error can be exploited to cause a heap-based buffer overflow via a specially crafted WRF file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in the following versions:
* T28 client builds prior to T28.4 (28.4)
* T27 client builds prior to T27LDSP32EP10 (27.32.10)

Solution:
Update to version 28.4 or 27.32.10.

Provided and/or discovered by
4) Oren Isacson, Core Security Technologies.

The vendor also credits Beyond Security, Codenomicon, and TELUS.

Original Advisory:
Cisco:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex

Core Security Technologies:
http://www.coresecurity.com/content/webex-wrf-memory-corruption-vulnerability

http://secunia.com/advisories/50905

ServersCheck Monitoring Software Cross-Site Request Forgery Vulnerability

Release Date : 2012-10-12

Criticality level : Less critical
Impact: Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: ServersCheck Monitoring Software 9.x

Description:
A vulnerability has been discovered in ServersCheck Monitoring Software, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. add an administrative user when a logged-in administrative user visits a specially crafted web page.

The vulnerability is confirmed in versions 9.0.17. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
loneferret

Original Advisory:
ServersCheck Monitoring Software:
http://www.serverscheck.dk/monitoring_software/release.asp

loneferret:
http://www.exploit-db.com/exploits/21866/

http://secunia.com/advisories/50908/

Release Date : 2012-10-12

Criticality level : Less critical
Impact: Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: vBSEO 3.x (module for vBulletin)

Description:
MegaMan has reported a vulnerability in vBSEO, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "u" parameter in member.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that "Visitor Messages" feature is enabled.

Solution:
No official solution is currently available.

Provided and/or discovered by:
MegaMan

Original Advisory:
MegaMan:
http://www.internot.info/forum/showthread.php?t=383

http://secunia.com/advisories/50842/

Release Date : 2012-09-27
Last Update : 2012-10-12

Criticality level : Moderately critical
Impact : Security Bypass
Where : From local network
Solution Status : Vendor Patch

Operating System : Thomson TWG850 Cable Modem

Description:
A security issue has been reported in Thomson TWG850 Cable Modem, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to missing authentication within the web-based management interface when processing requests with the "/goForm" URL. This can be exploited to alter any configuration setting via HTTP POST requests.

The security issue is reported in version ST9A.01.05 and ST9A.01.06. Other versions may also be affected.

Solution:
Update to version ST9A.01.12.

Provided and/or discovered by:
Glafkos Charalambous and George Nicolaou

Original Advisory:
http://dl.packetstormsecurity.net/1209-exploits/thomson-bypass.txt

http://secunia.com/advisories/50647